Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 022a26ff authored by Andrew Scull's avatar Andrew Scull Committed by Automerger Merge Worker
Browse files

Merge "Validate DICE chain based on context" am: e5a56100 am: e02b80a1 

Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/2485115



Change-Id: I374b8d28711ed76c6c9729f37069f30fb1aafe82
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents f850aba3 e02b80a1

security/keymint/support/remote_prov_utils.cpp

+7 −6
Original line number Diff line number Diff line
@@ -290,11 +290,12 @@ bytevec getProdEekChain(int32_t supportedEekCurve) { 
    return chain.encode();

}



ErrMsgOr<std::vector<BccEntryData>> validateBcc(const cppbor::Array* bcc) {

ErrMsgOr<std::vector<BccEntryData>> validateBcc(const cppbor::Array* bcc,

                                                hwtrust::DiceChain::Kind kind) {

    auto encodedBcc = bcc->encode();

    auto chain = hwtrust::DiceChain::verify(encodedBcc);

    auto chain = hwtrust::DiceChain::Verify(encodedBcc, kind);

    if (!chain.ok()) return chain.error().message();

    auto keys = chain->cose_public_keys();

    auto keys = chain->CosePublicKeys();

    if (!keys.ok()) return keys.error().message();

    std::vector<BccEntryData> result;

    for (auto& key : *keys) {
@@ -569,7 +570,7 @@ ErrMsgOr<std::vector<BccEntryData>> verifyProtectedData( 
    }



    // BCC is [ pubkey, + BccEntry]

    auto bccContents = validateBcc(bcc->asArray());

    auto bccContents = validateBcc(bcc->asArray(), hwtrust::DiceChain::Kind::kProtectedData);

    if (!bccContents) {

        return bccContents.message() + "\n" + prettyPrint(bcc.get());

    }
@@ -859,8 +860,8 @@ ErrMsgOr<bytevec> parseAndValidateAuthenticatedRequest(const std::vector<uint8_t 
        return "AuthenticatedRequest SignedData must be an Array.";

    }



    // DICE chain is [ pubkey, + DiceChainEntry ]. Its format is the same as BCC from RKP v1-2.

    auto diceContents = validateBcc(diceCertChain);

    // DICE chain is [ pubkey, + DiceChainEntry ].

    auto diceContents = validateBcc(diceCertChain, hwtrust::DiceChain::Kind::kAuthenticatedMessage);

    if (!diceContents) {

        return diceContents.message() + "\n" + prettyPrint(diceCertChain);

    }